The People's Bank of China has released new guidelines on
the collection and processing of personal financial information
(PFI Guidelines), which provide much-needed clarity on how personal
financial information in China should be processed, secured, and
transferred. While the PFI Guidelines do not impose an outright ban
on personal financial information leaving China, mandatory
compliance steps (including consent and impact assessments) must be
taken.
The PFI Guidelines will apply to regulated banks, financial
institutions and insurance companies.
Personal financial information (PFI) is widely defined. It
includes (personal and non-personal) information which is
collected, processed, generated and secured through the provision
of financial products or services within China. The PFI Guidelines
provide a non-exhaustive list of PFI and classifies them into three
categories depending on sensitivity and impact to data subjects in
the event of a data leakage incident,
